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We study the role of discrete rotational symmetry in quantum key distribution by generalizing 
the well-known Bennett-Brassard 1984 (BB84) and Scarani-Acin-Ribordy-Gisin 2004 (SARG04) 
protocols. We observe that discrete rotational symmetry results in the protocol's invariance to 
continuous rotations, thus leading to a simplified relation between bit and phase error rates and 
consequently a straightforward security proof. 



PACS numbers: 03.67.Dd, 03.67.-a 



I. INTRODUCTION 

Unlike classical cryptography which often rehes on un- 
proven assumptions on computational complexity to en- 
sure secrecy, quantum cryptography, or more precisely, 
quantum key distribution (QKD), provides proven un- 
conditional security against any attacks allowed by quan- 
tum mechanics. To date, most of these security proofs 
handle protocols on a case by case basis. In particular, 
two well-known QKD protocols, the Bennett-Brassard 
1984 (BB84) protocol P, [3, i, i, i, Q and the Scarani- 
Acin-Ribordy-Gisin 2004 (SARG04) protocol 0,11, BIS, 
have a collection of independent proofs despite sharing 
a variety of properties. For example, both schemes are 
prepare- and-measure protocols, implying that implemen- 
tation does not require a quantum computer but rather 
is within the ability of modern optical technology. Both 
protocols utilize qubits and use the same four quantum 
states to encode information. Thus, the quantum trans- 
mission part is the same. They differ only in the classi- 
cal discussion part (in particular, the basis reconciliation 
step). The two protocols organize the quantum states 
into bases in different manners; however, both exhibit 
discrete rotational symmetry among the states. The fun- 
damental difference between them arises from the fact 
that the pairs of basis states in SARG04 are not orthog- 
onal as they are in BB84. This non-orthogonality makes 
the SARG04 protocol more resilient to multiple-photon 
attacks and thus plays a practical role. 

In this letter, we wish to generalize the BB84 and 
SARG04 protocols to allow an arbitrary number of bases 
(M) and arbitrary angle (6*) between basis pairs. Our 
motivation is to better understand the role of discrete 
symmetry in QKD by studying the relation between these 
parameters and the resulting protocol security. The pre- 
vious work of Koashi [ll| has made strides in the subject. 
Nonetheless, we improve on his results in several areas. 
Firstly, we derive a closed form formula for the relation- 
ship between bit and phase error rates, thus allowing us 
to place tighter bounds on the quantum key generation 
rate. Secondly, our results hold for any value of 0, while 
Koashi requires 9 to take on discrete values related to M. 



Lastly, rather surprisingly, our closed form expression is 
independent of the number of the bases M for M > 2. 
Note that our result does not subsume Koashi's, since he 
studied the relations between bit and phase error rates for 
an arbitrary number of photons sent out by Alice while 
we consider only the single-photon case. 



II. THE GENERALIZED PROTOCOL 

We now describe the generalized QKD protocol. In 
this protocol, Alice prepares qubit states. Experimen- 
tally, these may be realized by polarization states. In the 
SARG04 protocol, Alice chooses from one of four pairs 
of basis states. We generalized the protocol, so that now 
she chooses from a set of A/ > 2 pairs. Hence each of 
the M basis pairs has a 1/M chance of being selected. 
Moreover, for each of the M basis pairs, the two states 
are separated by an angle 9 > (see Fig.[T]). Thus, when 
M = i,9 = 7r/2, the collection of states is identical to 
BB84 (here, we adopt a symmetrized version of BB84 
with four bases instead of two), while M = 4,9 = 7r/4 
reduces to the SARG04 protocol. Note that our gen- 
eralized protocol does not include the six-state protocol 
[12 . KLSl [l4J since the states in our generalized protocol 
lie on a plane in the Bloch sphere whereas the six states 
in the six-state protocol do not. 

In our notation it is convenient to introduce the ro- 
tation operator about the y-axis Rf3 = e~^^°'« , where 
dy — i{\lx){Ox\ — |Oa:)(la:|). Hcrc, the coefficient of 1 as 
opposed to 1/2 in the exponential arises from the fact 
that we are considering a spin-±l qubit, such as a pho- 
ton, embedded in a 3D Hilbert space. Thus, the x-basis 
kets satisfy: \lx) = i?^/2|0a;). 

We now denote the set of states that Alice may choose 
from by: {|(/)+,„), |0_,„)} for < to < A/ — 1. Further- 
more, these states take the following representation: 



D±m.) 



R 



■rmr/M 



cos-|Oa;) zbsin-lla 



(1) 



where jO^;) and |la;) are x-basis eigenkets. Thus, when 9 = 
■jt/2, the states \(p±m) become z-basis eigenkets. Also, by 



construction, the set of basis states \(j)±m) are simply 
rotated copies of each other, equaUy spaced at angular 
intervals of tt/M, about the upper half unit circle. Due 
to the rigid rotation of the basis states, each pair of states 
satisfies the inner product {(j)+rn\4'-m) ~ cos0, for < 
m< M -1. 



m = 




m = 2 



FIG. 1: The four graphs show the different pairs of qubits 
created by Alice (0 < m < 3). We allow for an arbitrary 
angle between the basis pairs 9. In the case when M = 4, 
6 = 7r/2, we recover BB84 (a symmetrized version with four 
bases), while 6 = 7r/4 recovers SARG04. One should note 
that when 6 = n/2, the states (l)±m become z-eigenstates. 

We outline the generalized prepare-and-nieasurc pro- 
tocol as follows: 

1 Alice prepares n qubits. For each qubit, she randomly 

chooses one of the M bases pairs. We denote her 
choice of basis by the set of numbers: < ^i < 
M — 1, where 1 < i < n. For each qubit, she also 
picks a random bit bi. 

2 For the ith state, Alice chooses the li basis and pre- 

pares either the state |0/.) if 6^ =0 or the state 

\cj)-i,) if h = 1. 

3 Alice sends her states over a quantum channel to Bob. 

4 Bob receives n possibly noisy qubits. For each state i, 

Bob chooses a random number ki representing the 
fcth basis. For each ki, he then randomly chooses 
one of two projection measurements (one projects 
onto the orthogonal states {\(f>ki),RTr/2\<Pki)} and 

the other onto {\(j)-ki),R-K/2\4>-ki)}) to measure the 
incoming state. When the measurement outcoinc is 
RTr/2\4'ki) or R^/2\4>-ki), he concludes that the in- 
coming state is l^-fcj or \(f>ki), respectively. When 
either of the other two outcomes occurs, he declares 
an inconclusive result for this state. 



5 Alice and Bob discuss over classical channels their 
preparation and measurement basis. They discard 
all i states where li ^ ki. Furthermore, the pair dis- 
card all states where Bob records an inconclusive 
measurement. 

Hence, on average, Alice and Bob retain Neon ~ n ■ 
Pcon/M bits, where Pcon is the probability of Bob's mea- 
surement is conclusive. When the quantum channel is 



perfect (i.e., no Eve), pc 



isin^ 



9. For some special 



cases such as the SARG04 protocol, the reduction by a 
factor of M can be avoided (i.e., Neon ~ n ■ Peon)- This 
is because the two projection measurements for the dif- 
ferent ki's are the same for SARG04. In other words, 
there are only two distinct measurements and are inde- 
pendent of ki, but the interpretation of the measurement 
outcomes is dependent on ki. Additionally, by the same 
token, the reduction by a factor of 2 in Pcon may not 
be needed in some protocols such as the BB84 protocol. 
This is because the two projection measurements for each 
ki are the same for BB84. 

Due to the possibility of a noisy quantum channel or 
the presence of Eve, the sequence of Neon bits shared 
by Alice and Bob will not be identical but rather have 
some fraction, Cb, of errors. Also, Eve may have some 
knowledge of the Neon bits. The remaining steps in the 
protocol describe the process of converting the insecure 
sequence of Neon bits into a shorter sequence of R ■ Neon ■ 
(1 — f) secure bits. These steps are analogous to those in 
BB84: 

6 Alice and Bob discuss and randomly choose a fraction 

t of their Neon bits. They reveal the values of their 
bits and estimate the error rate. 

7 In a large sampling, their estimated error rate will 

asymptotically approach the true error rate Cf,. 

8 Depending on the value of e^, the pair either abort the 

protocol or perform error correction and privacy 
amplification to distill a secure key of length R ■ 



Ne. 



(1-t). 



Without loss of generality and for simplicity, the states 
lost in the channel are excluded in the description above 
and also in the following derivations. To facilitate the 
study, we first convert our prepare-and-measure proto- 
col into an equivalent entanglement-distillation-protocol 
(EDP)-based QKD protocol (see [3). By the equivalence 
of the two protocol formulations, any results we derive 
with one, such as the bound on the secret key generation 
rate, apply directly to the other. 

To appreciate the connection between EDP and QKD, 
we observe that if Alice and Bob shared n pure EPR 
states of the form \tp) = ^(|00) -t- |ll))z, then individual 
measurements in the basis 10^), \lz) will produce n ran- 
dom, identical results. That is, Alice and Bob share an 
identical string of random states composed of either \0z) 
or II2). After associating logical values with the states, 



Alice and Bob will share a secure sequence of n random 
digits, exactly what is required for a key. 

In an EDP, Alice and Bob share n entangled bipar- 
tite quantum states. These states, are either mixed or 
pure. The task of generating an encryption key there- 
fore reduces to the problem of converting the entangled 
states into pure EPR pairs by using only local operations 
and classical communications (LOCCs). Once the couple 
obtains pure EPR pairs, they may simply measure their 
states and obtain a secure key as outlined above. 

To convert our generalized protocol into an EDP-based 
protocol, we must determine a suitable mathematical 
representation for the bipartite quantum states, pab, 
shared by Alice and Bob. We observe that in the prcparc- 
and-measure scheme, if Alice chooses the /th basis and 
randomly prepares either the state 10;) or \4>~i), then 
mathematically her preparation process is identical to 
the construction of the joint quantum state \iPi)ab = 

'[<^Ri^/m\'>Po)ab == ■^{\Qz)a\'I)i)b + \Iz)a\(I>-i)b), fol- 
lowed by a z-eigenbasis measurement in the A quantum 
subspace. The mathematical representation for pab is 
outlined as follows. In the subsequent notation we de- 

noteP(|.))=|.)(.|. 

Alice's Preparation : Alice prepares her states by 
choosing, with equal probability, among the differ- 
ent M bases. Hence in the EDP she will prepare 
the ensemble |i/;;), for < I < M — 1. Thus, for 
each l, Alice constructs the state; 



Pab 



'[lA®{Rl-n/M)B\i^o) 



AB 



(2) 



Noisy Channel : Alice sends the second qubit across 
a noisy channel to Bob. To model the noisy chan- 
nel we introduce a general quantum operator £, 
which maps density matrices to density matrices. 
Such an operator accounts for all possible quan- 
tum processes including, unitary evolution in an ex- 
tended Hilbert space and generalized POVM mea- 
surements made by an eavesdropper. In general, 
£{p) has a representation by a finite collection of 
operators {Ej} such that each EjE*- is positive, 

Y^EjE] = T, and £{p) -> Y.EjpE]. Thus, the 
noisy quantum channel transforms the density ma- 
trix according to: 



p\b -^ S{Pab) 

= ^p{Ia<» {EjRi^/m)b\iPo)ab 



(3) 



Bob's Filtering : Lastly, when Bob receives his quan- 
tum states, he randomly chooses one of the M bases 
to perform his measurements. For each choice, he 
further selects one of two projection measurements 
to measure the quantum state. As in Ref. Q, this 
measurement process can be modeled by a filtra- 
tion operation F, followed by a regular orthogonal 



measurement in the z-eigenbasis. Here, the Kraus 
filtration operator for the pair of states \<f>+o) and 
|</)_o) is: Fo - sin(0/2)|O,)(O,| +cos(0/2)|l,)(l,|. 
The corresponding filtration operator for a general 
pair of states \(f>-i) and \4>+i) is the rotated filter: 
Fi = FqR^it^/m- The Kraus filtration operator only 
transforms on the right side to ensure the invari- 
ance of Fo\ipo) = Fi\i/}i). Since Alice and Bob only 
retain states in which they choose the same prepa- 
ration and measurement basis, Bob's operation in 
the EDP corresponds to simply Fi = FoR-itt/m- 
Hence we have: 



j\/-i 



PAB = jj^Yl 'P[^a<E){FoR-u/mEjRi„/m)b\iPo)ab 

(4) 



j 1=0 



To sum over the M bases in equation (|4]), we expand 



out Ej = Uj + Vj, with Uj — ajai + a^ydy, Vj 



i'^x 



a-La 



al^z and complex coefficients a^ for r = i, x, y, z. Here 
dr are representations of the identity or Pauli matrices. 
Thus, Vj anti-commutes with ay while Uj commutes with 
both dy and Rp. It is also simple to prove from first 

principles that for M > 1, X)/=o R21-k/m = 0. Therefore 
we obtain: 



PAB 



-E 



V[{FaUj)BWo)AB 



M-1 



^ J2 P{iFoV,R2ln/M)B\A)AB 



1=0 



= FoJ2 U,\^o)AB{i'o\U^,+V,<^V^^ 



(5) 
Fl (6) 



where $ 



^M-l 



IT Si=0 R2lTT/M\''Po)AB{i'a\R~2lTT/M — 

^{Ta (E)Tb + |0).-(1| ® R-e + |1)^(0| ® Re)- Here the 
last equality holds only for M > 2 while in the case of 
Af = 2, $=|^o>ab(^o|. 

What is the effect of discrete averaging on p^s? 
Firstly, we observe that an arbitrary continuous rota- 
tion through an angle (3 by Alice and Bob transforms 



E, 



R-pEiR, 



■f3 



u, 



V,R2I3. 



Moreover, a close in- 



spection shows that for M > 2, $ commutes with I^Rp. 
Therefore, the process of discrete averaging results in the 
invariancc of <f> and pab to continuous rotations. The ori- 
gin of the symmetry derives from the mathematical form 
of $. By construction $ commutes with Bob's discrete 
rotations of 21'k/M and therefore has the same eigenspace 
as the discrete rotation operators. For M > 2, dis- 
crete and continuous rotations share the same eigenspace. 
Therefore $ must commute with all continuous rotations 
J15J . In contrast, when M = 2, the rotation operators un- 
der consideration are proportional to the identity. Hence, 
in this case, $ does not have the same eigenspace as the 
continuous rotation group and so the general M = 2 pro- 



tocol is not invariant under simultaneous rotations by 
Alice and Bob. 



A. Case one: ilf > 2 



III. SECURITY ANALYSIS 



We now proceed with the security analysis. The quan- 
tum bit error rate, e^, is the physical error rate expe- 
rienced by Alice and Bob during QKD. Such an error 
occurs when Alice prepares a logical or 1, while Bob 
conclusively measures 1 or 0. The bit error only gives a 
partial indication of the properties of a quantum chan- 
nel. One can imagine an eavesdropper or noisy channel 
altering the relative phase of a qubit without effecting 
bit error rate statistics. Just as e^ was introduced as 
the error obtained from Alice and Bob's preparation and 
measurement in the z-basis, we may introduce the phase 
error as the resulting error rate if the couple prepared 
and measured in the x-basis. To study bit and phase 
errors, we introduce the Bell basis: 



l^^i 



V2 



(|00)±|11))„|*±) = -^(|01)±|10)).. (7) 



The Bell diagonal elements of Alice and Bob's bipartite 
density matrix represent the probabilities of a quantum 
channel inducing various errors on their shared entan- 
gled state. That is, we may think of Alice and Bob 
originally sharing an entangled EPR pair while the ef- 
fect of an eavesdropper or noisy channel is to induce 
bit errors \0)z —^ \1) z and vice versa, or phase errors 
^(|0,) ± |1,)) ^ ^(|0,) T ID). Thus, the diagonal el- 
ements of the bipartite density matrix have the following 
form: 



PI = {'^+\pab\^+) 



P. = {^+\pab\^+) (8) 
Pz = {^~\pab\<^-). (9) 



Here, Px , Pz and Py represent the probabilities of a bit 
flip, phase flip and both bit and phase flip error. From the 
diagonal elements, we may extract closed form expres- 
sions for the errors, since et = Px +Py and Cp = Py + Pz- 
We may insert matrix representations and calculate the 
diagonal elements of pab explicitly. [As stated earlier, 
we always assume that 6 > 0.] Interestingly, in the case 
when M > 2, Eq. ^ simplifies significantly because of 
spherical averaging, resulting in expressions that are in- 
dependent of M; on the other hand, in the case when 
M = 2, spherical averaging does not simplify Eq. Q. 



For the M > 2 case, we have 



■ sm 



l^J2sm'ei\aif + \ai\') 



(10) 
(11) 



Py = ■^T.(^\<?+cos'0i\ai\' + \ai\')) (12) 



3 



^E(i<i' + i«'i'+2co«'^i<n (13) 



N' 



where A^' is a normalization constant (see Appendix \^ 
for detail). Thus, the relation between the bit and phase 
error rate is 



Gp = e(,(l + cos^ 



for M > 2. 



(14) 



We remark that this relation as well as the diagonal 
elements of the marginal density matrix, Eqs. (10)-(13), 
hold independent of the loss in the channel, and also 
independent of the number of bases M provided M > 2. 
In fact the only important value that still depends on 
M is the ratio of conclusively measured bits, Neon, to 
the total signal length n: Ncon/n. Here the ratio scales 
as 1/Af, since Bob has a \/M probability of choosing 
the same basis for his measurements as the one used by 
Alice during preparation. Consequently, there is little 
practical advantage for increasing the number of bases in 
the generalized 2D protocol. 



B. Case two: M = 2 



For the M = 2 case, the diagonal elements of pab are 



Px 



Py 



ai Psin^ I 



j 

N" ^ 
j 

— Til 

T\[" Z-^^' 
J 

-y 



al\^ + laiWos'^ t 



al\^ + \al\^ cosh 



(15) 
(16) 
(17) 
(18) 



and the bit and phase error rates are 

3 

^v = l^E(l«'J' + l«'H(l + c°«'^)' (20) 



where N" = J2^ sin^ 0(|a^' p + \ai\^) + (l + cos^ e){\al\^ + 
|a^P). Note that a direct relation between the bit and 
phase error rates cannot be readily observed for this case. 
In order to obtain this relation, we solve the problem of 
maximizing the phase error rate subject to a fixed bit 
error rate (see Appendix |B] for detail). The resulting 
relation between bit and phase error rates is as follows: 



e„ < 



1 + cos2 



-66, 



for M 



(21) 



Note that when 9 = tt/2, the phase error rate Cp goes 
to infinity. This is because the two states in the second 
basis of the protocol are the same (except for the phases) 
as the two states in the first basis (cf. Fig. [1]). Thus, the 
protocol consists of only two orthogonal states and QKD 
cannot be performed. 



C. Key generation rate 

We may utilize Shor-Prcskill's argument (a] to obtain 
the secret key generation rate [1^1 as (assuming the frac- 
tion t of test bits goes to zero) 



Rfi 



nal 



M 



[l - H2{eb) ~ H2{ep) 



(22) 



where H2{p) = -plog2(p) - (1 - p)log2(l - p) is the 
binary entropy function, e^ is the observed bit error rate, 
and Cp is the inferred phase error rate from Eq. (|14[) (for 
M > 2) or Eq. dUl) (for A/ == 2). For the Af > 2 case, 
we may increase the key generation rate by incorporating 
the mutual information between bit and phase errors. As 
in Ref. [lO|, we may parameterize the diagonal elements 
as follows: Px = eb — A, Pz = e.p — A, and py = A. The 
overall secret key generation rate is 



-Rfi 



nal 



M 



■[l-if4(l-e6-ep+A,e6-A,A,ep-A)]. (23) 



where H4{xi, X2, X3, X4) = J2i=i ~^i ^062 ^i- The param- 
eter A represents the mutual information, and in order to 
prove security, one needs to find the worst-case value of 
A to compute the worst-case key generation rate. When 
one assumes pessimistically that < A < et,, the worst- 
case value can easily be shown to be A = etep. In this 
case, no mutual information, if any, is incorporated in 
the key generation rate in Eq. ((23)) and it reduces to the 
rate in Eq. ([22]) . On the other hand, for the case when 
A/ > 2, we can see from Eqs. ([T0| to (fT3|) that the ad- 
missible range of A is actually ebcos^d < X < eb- In 
this case, the worst-case value of A is A = e?, cos^ 9 when 
Bb < cos^ 9/{l + cos^ 9) and is A = e^ep otherwise. 

As an example, we consider the SARG04 protocol 
{M = 4, 9 = 7r/4). Using Eq. ([H]), the relation between 
bit and phase error rates is Bp — 3eb/2. Assuming that 
Bb < 1/3, the worst-case value of A is A = eb/2. These 
results agree with those in Ref. [3, [lo] • 



IV. CONCLUSIONS 

In summary, we have proposed and proved the security 
of a generalized QKD protocol that includes the BB84 
and SARG04 protocols as specific cases. We have de- 
rived a closed form formula for the relationship between 
the bit and phase error rates of the generalized protocol. 
Such a relation allows us to place bounds on the security 
of the protocol. Therefore we have provided a unified 
security proof for protocols with discrete rotational sym- 
metry. We observe that when the number of bases is 
larger than two, discrete symmetry simplifies the effect 
of a noisy channel or eavesdropper, thus resulting in a 
simple relationship between bit and phase error rates. In 
this paper, we have only considered Abelian symmetry. 
In future, it may be interesting to consider the role of 
non- Abelian discrete symmetry in QKD. A similar secu- 
rity analysis involving a representation theory summa- 
tion ([5]) may prove useful when studying higher dimen- 
sional protocols such as the six-state protocol. 



APPENDIX A: CALCULATION OF THE 
COMPONENTS OF pab WHEN A/ > 2 

In this appendix, we calculate the diagonal elements 
of Pab given in Eq. ([4]). Specifically, we demonstrate 
by example how to derive Eqs. (fTm) - (fT5|) by explicitly 
deriving Eq. pT|) . The other equations can be obtained 
in a similar way. To proceed, we first prove the following 
lemma. 

Lemma 1. The following are spherical averages for M > 
2: 



±Y.co8'2l7r/M = 1/2 (Al) 

1=0 

A/-1 

— ^sin^2ln/M = 1/2 (A2) 



1=0 



M-l 



— ^ cos 2/7r/A/ sin 2?7r/A/ = 



(A3) 



/=o 



Proof. The trigonometric functions decompose into ex- 
ponentials as: 

cos2 2V^/ = i(2 + e4'-A^ + e-4'VM) (^4) 
sin2 2/7r/A/ == ^(2 -h le^'^^^ - ze-4'VA/)(A5) 

cos2lTT/Msm2lTT/M = --i{e^i^/^i - e"^^''/'^') (A6) 
In addition, we have the geometric series 

1 - 6^4^^ 



M-1 



-E 



^±4i7r/A/ 



1 _ g±47r/Af 





(A7) 
(A8) 



which foUows directly for M ^ 2 since the denomi- 
nator is finite. Thus, substitution of the former (|A4p 
into the latter (|A7p yields the desired result. In the 
special case where AI — 2, equation (|A7p is ill de- 
fined. Instead, we have by inspection summations of 
the form: ^ Ef=o cos^ Z7r/2 = (1 -f l)/4 = 1/2 and 

i S;=o ^^^^ ^7r/2 = 1/2, as required. D 



1. Calculation of Pa; 

We first take the inner product of pab given in Eq. (j4]) 
with the Bell state corresponding to a bit flip error: 

M-1 



(A9) 



M 



1=0 



iFoR_i^/MEjRi^/M)B\i^o)AB (AlO) 

Temporarily dropping the summation over channel op- 
erators Ej and inserting the x-basis representations for 

|^+) and \iP)ab we obtain: 

1 *^"'i 1 



Af ^IV2^ 



(cos-|00)B+sin-|ll)) 



(All) 



sm 



4M 



M-l 

■El 

/=0 



IR-Itt/mEjRitt/mIO) 



{1\R-i^/mEjRi^/m\1)\^ (A12) 

Lastly, we insert our matrix representations for the op- 
erators Ritt/m and Ej: 



sin^6i 
AM 



I ^ 

^ a^j; cos 2Z7r/M - a^ sin 2l7r/M (A13) 



sm 



AM 



E 



' cos^ 21tt/M + la^ p sin^ 21tt/M - 



(AM) 



(a2;a* -|-a^a*)cos2Z7r/Af sin2Z7r/Af J 
which, by our preliminary lemma, reduces to: 

Px = -sin^6'(|aj,p + ja^l^). 



(A15) 



By reintroducing the summation over j for the chan- 
nel operators Ej and normalizing, we obtain Eq. pTjl . 
The normalization constant in Eq. pTJ) is iV' = 



2E,I«: 



J|2ci,i2, 



tJ 1 2 



(1 



i^:P + laeP. The 



expressions for pi, py, and Pz can also be obtained in a 
similar way. 

APPENDIX B: RELATION BETWEEN BIT AND 
PHASE ERROR RATES WHEN M = 2 

In this appendix, we flnd the relation between the bit 
and phase error rates for the M = 2 case by solving 



the problem of maximizing the phase error rate given in 
Eq. ((20)) subject to a fixed bit error rate given in Eq. (|19p . 
This problem can be written as follows: 



maximize 

ep = {\ayf + \a,f)(l + cos^e) 
subject to 
Gb = |aa;psin^6'-h Iflyp + la^pcos^l 



(Bl) 

(B2) 

(B3) 
(B4) 

where the maximization is over \ap\'^ — jpj ^ logP, P € 
{i^x^y^z}. Here, the second constraint in Eq. (jB3P is 
due the normalization requirement that pi + Px + Py + 
Pz = 1. Since there are two equality constraints and four 
optimization variables, we may eliminate two variables, 
namely | fly ^ and | a^ p , and simplify the problem to 



maximize 














ep = l-(|a,p + |a,nsin2 (B5) 


subject to 


1 


eb^A 


+ 


A -B 
-B A 




\ax? 


> (B6) 


sin^ei 


\az\'^,\a 


x|'>0 










(B7) 



where B = 1/(1 -I- cos^ 0) and A = Bcos^ 9. Here, the 
objective function in Eq. (jBSP is obtained by substituting 
Eq. dm in Eq. jHU; the left-hand side of Eq. (Ell) is 



obtained by solving Eqs. (|B2)) and (|B3l) for [|ayp; la^P], 
which are both greater than zero according to Eq. (|B4p . 
thus leading to the inequality in Eq. (jB6p . Note that 
in general jcip = la^P = (giving arise to ep = 1) 
may not be a feasible solution. The simplified problem 
is a linear programming problem; the four constraints 
in the problem correspond to four lines and the objective 
function corresponds to a line in a two-dimensional space. 
Suppose that we are interested in the case when eb < A 
(which turns out to cover the entire range of Cp, < ep < 
1). Given that Cb < A, one can easily find the feasible 
region and the maximizing point ( | a,; p , | a^^ p ) . It turns 
out that the maximizing point is 



(klM«.P)- 



A-Cb 

Ash-i^e" 



(B8) 



and the maximum phase error rate is 



1 + cos'' 
cos 2 9 



-Cb, for M = 2 and eb < 



cos^ 9 



1 + cos2 



(B9) 
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Our summation for $ echoes Schur's lemma, however we 
work with reducible representations of the rotation oper- 
ators. Hence, "I> is not proportional to the identity. 
Note that one can show if ej, = 0, the normalized con- 
clusive probability Pcon = 5 sin^ 6 while ej > implies 



